cloak
Activity analysis
HackerFeeds has tracked 168 victims claimed by cloak since August 2023, most recently in October 2026 — ranking #47 of 332 groups (0.5% of all tracked ransomware victims). It posted 2 victims in the last 90 days, down 50% on the previous 90 days (4). Its most-targeted sector is Business Services (31 victims), followed by Manufacturing (14). The United States accounts for 42 victims (30% of those with a known location); 27 victims did not disclose a location.
Victims per year
- 202334
- 202480
- 202544
- 202610
Top sectors
- Business Services31
- Manufacturing14
- Technology13
- Healthcare8
- Financial Services7
- Transportation/Logistics6
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe — especially Germany — across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.
Recent victims
No victims tracked yet.